Electronic control unit and electronic control system

ABSTRACT

In an electronic control unit, it is determine whether a data frame received from a different electronic control unit via a communication network is abnormal. A prediction data, which is predicted to be a normal data supposed to be included in the data frame determined to be abnormal, is generated by using a past data that is a data included in stored data frames, based on a stored prediction generation method. A prediction data frame including the prediction data is transmitted via the communication network.

CROSS REFERENCE TO RELATED APPLICATIONS

The present application is a continuation application of InternationalPatent Application No. PCT/JP2019/019866 filed on May 20, 2019, whichdesignated the U.S. and claims the benefit of priority from JapanesePatent Application No. 2018-112285 filed on Jun. 12, 2018. The entiredisclosures of all of the above applications are incorporated herein byreference.

TECHNICAL FIELD

The present application relates to a technique for suppressingunauthorized control against an electronic control unit (ECU: ElectronicControl Unit) via a network, and is mainly used for an electroniccontrol unit and an electronic control system for a vehicle.

BACKGROUND

In recent years, various types of electronic control units, which areconnected to each other via an in-vehicle network such as a CAN(Controller Area Network), are mounted on an automobile. Theseelectronic control units include electronic control units that controlthe operation of the vehicle, such as the engine and steering wheel.Therefore, in order to ensure the safety of the vehicle, high securityis required to prevent the electronic control unit from beingincorrectly controlled by an unauthorized access by a third party, or toinvalidate the unauthorized control performed by a third party.

SUMMARY

According to an example of the present disclosure, an electronic controlunit is provided as follows. In the electronic control unit, it isdetermine whether a data frame received from a different electroniccontrol unit via a communication network is abnormal. A prediction data,which is predicted to be a normal data supposed to be included in thedata frame determined to be abnormal, is generated by using a past datathat is a data included in stored data frames, based on a storedprediction generation method. A prediction data frame including theprediction data is transmitted via the communication network.

BRIEF DESCRIPTION OF DRAWINGS

The objects, features, and advantages of the present disclosure willbecome more apparent from the following detailed description made withreference to the accompanying drawings. In the drawings:

FIG. 1 is a diagram illustrating a configuration of an electroniccontrol system according to a first embodiment;

FIG. 2 is a block diagram illustrating a configuration of an electroniccontrol unit according to the first embodiment;

FIG. 3 is a diagram illustrating an example of a format of a data frame;

FIG. 4 is a diagram illustrating an example of information list of ageneration method storage;

FIG. 5 is a diagram illustrating an operation of the electronic controlunit according to the first embodiment;

FIG. 6 is a diagram illustrating an operation of the electronic controlunit according to the first embodiment;

FIG. 7 is a diagram illustrating a prediction data generation method;

FIG. 8 is a diagram illustrating a prediction data generation method;

FIG. 9 is a diagram illustrating a configuration of an electroniccontrol system according to a second embodiment; and

FIG. 10 is a block diagram illustrating a configuration of an electroniccontrol unit according to a third embodiment.

DETAILED DESCRIPTION

Embodiments of the present disclosure will be described below withreference to the drawings. Note that the present disclosure is notlimited to the embodiments below. Any effects described in embodimentsare effects obtained when a configuration of an embodiment as an exampleof the present disclosure, and are not necessarily an effect of thepresent disclosure. When there are a plurality of embodiments, theconfiguration disclosed in each embodiment is not limited to eachembodiment alone, and may be combined across the embodiments. Forexample, the configuration disclosed in one embodiment may be combinedwith another embodiment. Further, the disclosed configurations may becollected and combined in each of the plurality of embodiments.

First Embodiment

FIG. 1 shows an electronic control system 1 for a vehicle; theelectronic control system 1 includes a plurality of electronic controlunits. In the electronic control system 1 shown in FIG. 1 , a pluralityof electronic control units are connected via a communication network101. In addition to an electronic control unit 100 having functionsdescribed in the present embodiment, two electronic control units (atransmission-source electronic control unit 102 and atransmission-destination electronic control unit 103) are provided.Further, the transmission-source electronic control unit 102 and thetransmission-destination electronic control unit 103 are respectivelyconnected to respective sensors that detect the states of a host vehicleand surrounding vehicles.

The electronic control units included in the electronic control system 1transmit and receive data and the like acquired from the sensors, viathe communication network 101. The communication network 101 may includeoptional communication systems such as CAN (Controller Area Network),LIN (Local Interconnect Network), Ethernet (registered trademark), Wi-Fi(registered trademark), and Bluetooth (registered trademark). In thefollowing example, an example using CAN will be described.

The electronic control unit 100 may be configured as, for example, aso-called information processing device that is mainly configured by asemiconductor device and includes a CPU (Central Processing Unit) and avolatile storage such as a RAM (Random Access Memory). In this case, theinformation processing device may further include a nonvolatile storagesuch as a flash memory, and a network interface unit connected to acommunication network. In addition, such an information processingdevice may be a packaged semiconductor device or a configuration inwhich respective semiconductor devices are connected by wiring on awiring board.

In the present embodiment, an example will be described in which theelectronic control system 1 includes the electronic control unit 100 asa special-purpose electronic control unit that exhibits the functionsdescribed in the present embodiment. In contrast, the electronic controlunit 100 does not necessarily have to be a special-purpose electroniccontrol unit; namely, an electronic control unit having another functionmay be configured to further include the functions described in thepresent embodiment to thereby function as the electronic control unit100. Further, a gateway (not shown) includes (i) a relay function ofdata communication performed between a plurality of communicationnetworks mounted on the vehicle and (ii) a communication function withthe outside of the vehicle. Such a gateway may be configured to includethe functions of the present embodiment to thereby function as theelectronic control unit 100.

Further, FIG. 1 shows an example in which the electronic control system1 includes only the electronic control unit 100, the transmission-sourceelectronic control unit 102, and the transmission-destination electroniccontrol unit 103. However, it should be understood that the electroniccontrol system 1 may include any number of electronic control unitsconnected via the communication network 101.

1. Configuration of Electronic Control Unit 100

The configuration of the electronic control unit 100 of this embodimentwill be described with reference to FIG. 2 . The electronic control unit100 includes a reception unit 10 (which will also be referred to as areceiver 10), a data frame storage 11, a generation method storage 12,an abnormality determination unit 13, a prediction data generation unit14, and a transmission unit 15 (which will also be referred to as atransmitter 15). Note that, in the present embodiment, an example inwhich the electronic control unit 100 includes all the elements shown inFIG. 2 will be described. However, the elements shown in FIG. 2 may beprovided across a plurality of electronic control units.

The receiver 10 receives a data frame transmitted/received between twoor more electronic control units connected via the communication network101. In the case of the electronic control system 1 shown in FIG. 1 ,the receiver 10 of the electronic control unit 100 receives data framestransmitted from the transmission-source electronic control unit 102(corresponding to a different electronic control unit).

FIG. 3 shows an example of a format of a data frame transmitted/receivedvia the communication network 101. The data frame shown in FIG. 3includes (i) an ID field (CAN-ID) having identification information(hereinafter referred to as a frame ID) of a data frame communicated byCAN, (ii) a length field (DLC) indicating the length of the data field,and (iii) a data field having one or more signal segments. Data such asvehicle speed or pressure acquired from a sensor is stored in eachsignal segment of the data field. The frame ID is specificidentification information assigned according to the type of dataincluded in the signal segment. That is, the same frame ID is assignedto the data frames having the same type of data included in the signalsegments.

The data frame storage 11 (corresponding to a first storage) stores thedata frames received by the receiver 10. The data frame storage 11 maystore all the contents included in the data frame received by thereceiver 10; alternatively, only a part of the data frame, for example,only the frame ID and the data stored in the signal segment may bestored. The data frame storage 11 may further store the reception timeof the data frame by the receiver 10 in association with the data frame.In the present embodiment described below, the data frame storage 11stores all data frames that are determined not to be abnormal by theabnormality determination unit 13, as described later. However, the dataframe storage 11 may store only data frames having a specific frame IDor data stored in a specific signal segment. Further, in order to securethe memory capacity, the data frames may be configured to be stored fora fixed period or a fixed number. Here, “storing a data frame” of thepresent disclosure includes not only the case of storing the entire dataframe but also the case of storing only a part of the contents includedin the data frame.

The generation method storage 12 (corresponding to a second storage)stores a method of predicting and generating data included in a dataframe (hereinafter, prediction generation method). The predictiongeneration method is written and stored in advance in the generationmethod storage 12 before the electronic control unit 100 executes theoperation described below. Therefore, the prediction generation methodis written by a vehicle manufacturing factory or a manufacturing factoryof an electronic control unit before shipping from the factory, orwritten or updated by a dealer after shipping from the factory, forexample.

FIG. 4 shows an example of an information list showing the predictiongeneration method stored in the generation method storage 12. In FIG. 4, the generation method storage 12 stores, in addition to the predictiongeneration method, the followings: a frame ID (for example, 0x001 or thelike) assigned to the type of prediction data generated by theprediction generation method; information indicating the signal segmentin which the prediction data is stored (for example, signal A); a signalsegment start point indicating the position of this signal segment inthe data frame; a bit length of this signal segment; and a data listrequired for prediction generation, for example, data used in theprediction generation method and information indicating a storagedestination of the data in the data frame storage 11. However, theinformation list shown in FIG. 4 is merely an example, and thegeneration method storage 12 may store information other than thoseshown in FIG. 4 .

The abnormality determination unit 13 determines the presence/absence ofabnormality in data frame received by the receiver 10. Here, theabnormality of the data frame of the present disclosure includes notonly the case where the data frame itself or the contents of the dataframe is abnormal, but also the case where the time at which the dataframe is transmitted or received is not normal.

The method by which the abnormality determination unit 13 determineswhether the data frame is abnormal is optional. As an example, theabnormality determination unit 13 may determine whether the data frameis abnormal based on the reception time of the data frame. For example,some data frames are transmitted from a specific electronic control unitwith regular time intervals. For such a data frame, the scheduledreception time of the next data frame can be calculated based on thetransmission cycle of the data frame and the reception time at which thereceiver 10 received the latest data frame. However, if there is a largediscrepancy between the scheduled reception time and the actualreception time of the next data frame, it is highly likely that thisdata frame was not transmitted normally. Therefore, if the differencebetween the scheduled reception time and the actual reception time isgreater than or equal to a certain value, the abnormality determinationunit 13 determines that the data frame received at this reception timeis abnormal. Alternatively, even when a plurality of data frames arereceived near the scheduled reception time, there is a high possibilitythat some or all of these data frames are abnormal. Therefore, even insuch a case, the abnormality determination unit 13 determines that someor all of the plurality of data frames received near the scheduledreception time are abnormal.

The prediction data generation unit 14 generates a prediction data thatis predicted as “normal data supposed to be included” in the data framethat is determined to be abnormal, based on the prediction generationmethod stored in the generation method storage 12. This prediction datais, for example, a normal data that is supposed to be included in thedata frame when it is assumed that the data frame determined to beabnormal is transmitted at the predetermined frame transmission time(corresponding to the predetermined transmission time). As shown in FIG.4 , the generation method storage 12 stores a plurality of predictiongeneration methods in the information list. Therefore, the predictiondata generation unit 14 selects a prediction generation method from theinformation list based on a specific data type such as vehicle speed orpressure included in the data frame determined to be abnormal. Aprediction data is then generated based on the selected predictiongeneration method. This prediction data is generated by the predictiondata generation unit 14 by acquiring data (corresponding to a past data)necessary for generating the prediction data from the data frames storedin the data frame storage 11, and performing an operation or the like onthese data. In the embodiment shown in FIG. 4 , the generation methodstorage 12 stores a data list indicating data necessary for theprediction generation together with the prediction generation method.Therefore, the prediction data generation unit 14 may read and acquirethe data shown in the data list from the data frame storage 11. However,the data list may not be included in the information list stored in thegeneration method storage 12. In such a case, the prediction datageneration unit 14 determines the data necessary for executing thisprediction generation method based on the prediction generation methodread from the generation method storage 12; then, based on thedetermination result, necessary data may be acquired from the data framestorage 11. Here, the “normal data supposed to be included” in the dataframe of the present disclosure is not limited to the data that shouldbe originally included when the data frame determined to be abnormal istransmitted from the transmission-source electronic control unit. Forexample, “normal data supposed to be included” also includes data thatis predicted/generated in consideration of a difference intransmission-source electronic control unit, a difference intransmission time, or a type or attribute of data to be transmitted. Asan example, “normal data supposed to be included” may be a data that isincluded when the data frame determined to be abnormal is assumed to betransmitted at a time different from the transmission time at which thedata frame determined to be abnormal is transmitted from thetransmission-source electronic control unit.

The prediction data generation unit 14 further stores the generatedprediction data in a predetermined signal segment based on theinformation of the signal segment shown in the information list of thegeneration method storage 12. At the same time, the signal segment isarranged at a predetermined position of the data frame based on theinformation indicating the start point of the signal segment and theinformation indicating the bit length of the signal. As a result, aprediction data frame including the prediction data is generated. Notethat the data frame may have multiple signal segments in the data field.In such a case, the prediction data generation unit 14 generates theprediction data to be stored in each of the plurality of signal segmentsbased on each prediction generation method. Then, the generatedprediction data is stored in each signal segment, and each signalsegment is arranged at a predetermined position to generate a predictiondata frame.

The transmitter 15 transmits the prediction data frame generated by theprediction data generation unit 14. In addition, the prediction datageneration unit 14 may generate a normal data that is supposed to beincluded in a data frame on the assumption that the prediction data istransmitted at a predetermined frame transmission time. In such a case,the transmitter 15 transmits the prediction data frame at thepredetermined frame transmission time. Here, the frame transmission timeis a time obtained by adding the time required to generate and transmitthe prediction data frame to the time when it is determined that thedata frame is abnormal. For example, the frame transmission time is thetime when the prediction data frame including the prediction data can betransmitted without delay after the prediction data is generated.However, in addition to this, it may be the time after a predeterminedwait is inserted after the prediction data is generated. That is, thepredetermined transmission time corresponds to the time lag after theabnormality is detected until the electronic control unit 100 transmitsthe prediction data frame. Depending on the processing speed of theelectronic control unit 100, the frame transmission time and the timewhen it is determined that there is an abnormality may be evaluated tobe substantially the same time. Note that the time of abnormalitydetection is approximately the same as the time at which a differentelectronic control unit transmits the data frame.

2. Operation of Electronic Control Unit 100

Next, the operation of the electronic control unit 100 will be describedwith reference to FIGS. 5 and 6 . FIG. 5 shows the operation when thereis no abnormality in the data frame received by the receiver 10; FIG. 6shows the operation when there is an abnormality in the data frame.

The receiver 10 receives a data frame transmitted/received between theelectronic control units connected via the communication network 101(S101). Upon receiving the data frame, the receiver 10 requests theabnormality determination unit 13 to determine whether the received dataframe has an abnormality (S102). At this time, the receiver 10 maynotify the abnormality determination unit 13 of the received data frameand its reception time together with the abnormality determinationrequest. Then, the abnormality determination unit 13 that has receivedthe request in S102 determines whether the received data frame isabnormal (S103).

When it is determined that the data frame is not abnormal as shown inFIG. 5 , the abnormality determination unit 13 notifies the receiver 10of the determination result indicating that the data frame is notabnormal (S104). Then, the receiver 10 stores the data frame received inS101 in the data frame storage 11 (S105). Note that in the embodimentshown in FIG. 5 , only the data frames determined to be not abnormal arestored in the data frame storage 11, but all the data frames received bythe receiver 10 may be stored in the data frame storage 11.

On the other hand, as shown in FIG. 6 , it is determined that the dataframe is abnormal as a result of determining whether the data frame isabnormal in S103. In this case, the abnormality determination unit 13requests the prediction data generation unit 14 to generate a predictiondata (S114). At this time, the abnormality determination unit 13 maynotify the prediction data generation unit 14 of the frame ID of thedata frame determined to be abnormal, the frame reception time, the dataincluded in the data frame, and the like.

The prediction data generation unit 14 receives the prediction datageneration request from the abnormality determination unit 13. Theprediction data generation unit 14 then reads out a predictiongeneration method, a data list indicating data necessary for predictiongeneration, and the like from the information list stored in thegeneration method storage 12, based on the data included in the dataframe determined to be abnormal (S115).

At this time, the prediction data generation unit 14 may select and readout the prediction generation method corresponding to the data includedin the data frame determined to be abnormal using the frame ID assignedaccording to the type of data. For example, when the frame ID of thedata frame determined to be abnormal is “0x001”, the data in the firstrow is read from the information list shown in FIG. 4 . When the frameID is “0x002”, the data in the second row and the data in the third roware read out from the information list shown in FIG. 4 .

In S115, the prediction data generation unit 14 reads out the predictiongeneration method and the like from the information list of thegeneration method storage 12. The prediction data generation unit 14then reads the data necessary for executing the read predictiongeneration method from the data frame storage 11 (S116).

Next, the prediction data generation unit 14 generates a prediction datausing the data (corresponding to a past data) read from the data framestorage 11 based on the prediction generation method read in S115(S117). The prediction data generation unit 14 further generates aprediction data frame including the generated prediction data (S118).

Then, the prediction data generation unit 14 requests the transmitter 15to transmit the generated prediction data frame (S119). Upon receivingthe transmission request from the prediction data generation unit 14,the transmitter 15 transmits the prediction data frame (S120).

The transmission-destination electronic control unit 103 receives thesame data frame as the data frame received by the receiver 10 in S101,and then receives the prediction data frame transmitted from thetransmitter 15 in S120. The transmission-destination electronic controlunit 103 reads out the latest one from the received data frames by LIFOcontrol, controlling based on the data included in the data frame. Thatis, suppose a case where the transmission-destination electronic controlunit 103 receives the prediction data frame transmitted from thetransmitter 15 in S120 before being controlled by the previouslyreceived data frame. The transmission-destination electronic controlunit 103 is controlled by this prediction data frame.

3. Generation of Prediction Data Based on Prediction Generation Method

Next, the prediction generation method stored in the generation methodstorage 12 will be exemplified, and a specific prediction datageneration method will be described. The prediction generation methodshown below is merely a representative example, and the predictiongeneration method used in the present embodiment is not limited to theexample shown below.

(a) Generation of Prediction Data Predicted from Data of the Same Typeas that of Abnormal Data

The following will describe a method of generating a prediction datapredicted from data of the same type as that of the abnormal dataincluded in the data frame determined to be abnormal among the datastored in the data frame storage 11.

For example, when the abnormal data is a data on steering angle of thevehicle, the prediction data A is generated using the data on the paststeering angle based on the prediction generation method shown in thefollowing Expression (1).A=a ₁+(a ₁ −a ₂)/T×(t ₀ −t ₁)  (1)

Here, a₁ is the first latest data regarding the steering angle includedin the data frame stored in the data frame storage 11; a₂ is the secondlatest data, which precedes a₁, regarding the steering angle included inthe data frame stored in the data frame storage 11. T is a transmissioncycle of a data frame including data on steering angle. Further, t₀ is ascheduled transmission time at which the data frame generated by theprediction data generation unit 14 is scheduled to be transmitted fromthe transmitter 15. t1 is the reception time when the receiver 10receives the data frame including a₁. The scheduled transmission time tocan be calculated by adding the reception time of the data framedetermined to be abnormal and the time required to generate and transmitthe data frame including the prediction data.

Note that the generation method storage 12 stores the data listnecessary for the prediction generation. In the above example, as shownin the first row of the information list shown in FIG. 4 , a₁, a₂, andt₁ are described in the data list. The prediction data generation unit14 reads these data from the data frame storage 11 and generates theprediction data A based on Expression (1).

FIG. 7 is a diagram illustrating this prediction generation method. In aknown technology, the content of the data frame for invalidating theunauthorized frame is the same as the data frame received immediatelybefore. Therefore, the electronic control unit will transmit the data ofa₁ at the scheduled transmission time to. However, considering that thesteering angle increases with time from a₂ to a₁, as shown by the brokenline in FIG. 7 , the steering angle at the scheduled transmission timeto is more likely to increase to more than a₁. Therefore, the steeringangle at the scheduled transmission time to is predicted based on theprediction generation method shown in Expression (1), and the predictiondata A is generated.

For example, the prediction data A of the steering angle will becalculated under the following conditions: the steering angle a₁ storedin the data frame storage 11 is 30.0°; the reception time t1 of thesteering angle a₁ is 10.00 seconds; the steering angle a₂ is 29.0°; thedata frame transmission period T is 1.0 second; the reception time ofthe data frame determined to be abnormal is 10.05 seconds; and the timerequired to transmit a data frame is 0.05 seconds. In this case, theprediction data A of the steering angle is calculated to be 30.1° basedon Expression (1). Therefore, the transmitter 15 transmits theprediction data frame including the generated prediction data of 30.1°at the scheduled transmission time of 10.10 seconds (10.05+0.05seconds).

In another example, the prediction data may be generated based on anaverage of data of the same type as that of the abnormal data among thedata stored in the data frame storage 11. For example, the lightingstate of a fog lamp of a vehicle typically does not change frequently.Assume that an abnormal data frame or a data estimated to be included ina data frame determined to be abnormal was transmitted at a specifiedframe transmission time. Under such assumption, it is highly possiblethat all normal data supposed to be included in the data frame are thesame as the lighting state of the fog lamp in the past. Therefore, whenthe abnormal data included in the data frame determined to be abnormalis data indicating the lighting state of the fog lamp of the vehicle,the prediction data is generated from the average of data indicating thepast lighting state of the fog lamp. Specifically, suppose a case, thedata frame storage 11 stores ten pieces of data indicating past lightingstates of fog lamps, nine pieces of which indicate lighting of the foglamp and one piece of which indicates non-lighting of the fog lamp.Under such a case, the prediction data generation unit 14 generates, asthe prediction data, data indicating lighting of the fog lamp, which isthe average data or higher.

(b) Generation of Prediction Data Predicted from Data of a TypeDifferent from that of Abnormal Data

In (a), the prediction data predicted from the same type of data as thatof the abnormal data is generated, but the prediction data predictedfrom the data of a different type from that of the abnormal data may begenerated.

For example, when the abnormal data is data related to the vehiclespeed, the prediction data B is generated using the past vehicle speeddata and the data other than the vehicle speed based on the predictiongeneration method shown in the following Expression (2).B=b ₁ +c ₁×(t ₀ −t ₁)  (2)

Here, b₁ is the latest data regarding the vehicle speed stored in thedata frame storage 11, and c₁ is the latest data regarding theacceleration stored in the data frame storage 11. Further, t₁ is thereception time when the receiver 10 receives the data frame includingb₁.

In addition, when the generation method storage 12 stores a data listnecessary for prediction generation, b₁, c₁, and t₁ are included in thedata list as shown in the second row of the information list shown inFIG. 4 . The prediction data generation unit 14 reads out these datafrom the data frame storage 11 and generates the prediction data B basedon Expression (2).

For example, the predicted vehicle speed data B will be calculated underthe following conditions: the vehicle speed b₁ stored in the data framestorage 11 is 30.0 km/h; the reception time t₁ of b₁ is 10.00 seconds;the acceleration c₁ is 1.0 m/s2; the reception time of the data framedetermined to be abnormal is 10.05 seconds; and the time required totransmit a data frame is 0.05 seconds. In this case, the predictedvehicle speed data B is calculated as 30.36 km/h based on Expression(2). Therefore, the transmitter 15 transmits the prediction data frameincluding the prediction data of 30.36 km/h at the transmission time of10.10 seconds.

In the above example, when the abnormal data is data related to thevehicle speed, the prediction data is generated using data other thanthe vehicle speed (for example, acceleration data) in addition to thepast vehicle speed data. In contrast, as described below, the predictiondata may be generated using only the data of a type completely differentfrom that of the abnormal data.

For example, in a vehicle equipped with a driving support system, abrake request is generated by determining compositely a plurality offactors such as the speed of the host vehicle, the speed of a vehicletraveling in front of the host vehicle (hereinafter referred to as the“front vehicle”), and the inter-vehicle distance to the front vehicle.Therefore, when the abnormal data is data related to the brake request,it is desirable to use the data that is completely different from thedata related to the past brake request to generate the prediction data.The following will describe an example of a prediction generation methodof prediction data which is a brake request. FIG. 8 is a diagramillustrating this prediction generation method.

The prediction data generation unit 14 executes the followingExpressions (3) to (8) to generate prediction data. First, the relativeacceleration an of the host vehicle with respect to the front vehicle iscalculated according to the following Expression (3).ar ₁=(vr ₁ −vr ₂)/(t ₁ −t ₂)  (3)

Here, vr₁ is the (first) latest data regarding the relative speed withrespect to the front vehicle stored in the data frame storage 11: vr₂ isthe second latest data, which precedes vr₁, regarding the relative speedwith respect to the front vehicle stored in the data frame storage 11.Further, t₁ and t₂ are the reception times of vr₁ and vr₂ in thereceiver 10, respectively. Note that an corresponds to the rate ofchange of the relative speed between t₁ and t₂, as shown in FIG. 8 .

The following will calculate the acceleration a1 of the front vehicleusing the relative acceleration an calculated by Expression (3) from thefollowing Expression (4).a1=a0−ar ₁  (4)

Here, a0 is data regarding the acceleration of the host vehicle storedin the data frame storage 11.

Next, the relative acceleration ar₀ of the host vehicle with respect tothe front vehicle at the time of emergency braking is calculated basedon Expression (5) by using the acceleration a1 of the front vehiclecalculated by the equation (4) and the acceleration g when the emergencybrake is applied.ar ₀ =g−a1  (5)

Note that ar₀ corresponds to the rate of change of the relative speedafter t1, as shown in FIG. 8 .

Further, Expression (6) is calculated using the relative speed vr₁ usedin Expression (3) and the relative acceleration ar₀ during emergencybraking calculated in Expression (5). Thereby, the time Δt requireduntil the relative speed of the host vehicle to the front vehiclebecomes 0, that is, the speeds of the front vehicle and the host vehiclebecome equal when the emergency brake is applied.Δt=−vr ₁ /ar ₀  (6)

Next, a predicted braking distance R0 predicted to be required until therelative speed of the host vehicle to the front vehicle becomes 0 whenthe emergency brake is applied is calculated based on the equation (7),by using the relative acceleration ar₀ of the host vehicle with respectto the front vehicle when the emergency brake is applied, calculated byExpression (5), and the time Δt calculated by Expression (6).R0=vr ₁ ×Δt+½×ar ₀ ×Δt ²  (7)

Here, the predicted braking distance R0 obtained by Expression (7) iscompared with the actual inter-vehicle distance R between the frontvehicle and the host vehicle stored in the data frame storage 11. Here,when the predicted braking distance R0 is larger than the actualinter-vehicle distance R, the relative speed of the host vehicle to thefront vehicle becomes 0. The host vehicle may collide with the frontvehicle before the speeds of the front vehicle and the host vehiclebecome equal. Therefore, in the case of R0>R, the prediction datageneration unit 14 generates, as the prediction data, data indicatingthat there is a brake request. On the other hand, as a result of theabove series of calculations, when R0⇐R, the inter-vehicle distancebetween the front vehicle and the host vehicle can be sufficientlysecured when the speeds of the front vehicle and the host vehicle becomeequal. Therefore, the prediction data generation unit 14 generates, asthe prediction data, data indicating that there is no brake request.Assume that the data that may be included in the data frame determinedto be abnormal or the abnormal data frame is transmitted at apredetermined frame transmission time. In such an assumption, dataindicating the presence/absence of a brake request is transmitted asnormal data supposed to be included in the data frame.

The above example has described an example in which the steering angle,the lighting state of the fog lamp, the vehicle speed, and the brakerequest are generated as the prediction data. However, the types of datadescribed above are merely examples, and optional data can be generatedas prediction data. For example, the engine speed, which can change itsnumerical value continuously such as the vehicle speed, may be generatedas a prediction data. Alternatively, for example, data indicating ON/OFFof ACC (Adaptive Cruise Control) may be generated as a prediction dataas the data represented by the discrete value like the lighting state ofthe fog lamp. Also, the vehicle speed is shown as an example of aprediction generation method using data of a type different from that ofthe abnormal data. However, in order to generate the prediction data ofthe vehicle speed, the acceleration data may not be used, and only thepast vehicle speed data may be used.

Furthermore, the above example has described (i) the predictiongeneration method based on the assumption that the data changes linearlyand (ii) the prediction generation method using the average. However,the prediction generation method of this embodiment is not limited tothe exemplified method, and any method can be used. For example, theprediction data may be generated by the least square method using aplurality of data stored in the data frame storage 11.

Further, in the present embodiment, it is sufficient that the data frametransmitted from the transmitter 15 includes the prediction datagenerated based on the prediction generation method, and data other thanthe prediction data may be included. For example, since the vehicleidentification information does not change over time, such a constantdata is always stored in the signal segment in which the vehicleidentification information is stored. In such a case, the predictiondata generation unit 14 stores the prediction data generated based onthe prediction generation method of this embodiment in the signalsegment A, and stores data such as vehicle identification informationthat is different from the prediction data generated based on theprediction generation method in the signal segment B. A data frame isthus generated.

For example, the prediction data generation unit 14 may store thevehicle identification information in the memory and add the storedvehicle identification information to the generated prediction data togenerate the prediction data frame. Alternatively, even constant datasuch as vehicle identification information may be generated using thesame method as the prediction data of the present embodiment. In thiscase, as shown in the third row of the information list shown in FIG. 4, the generation method storage 12 stores the prediction generationmethod of C=c1. Here, c1 is the latest data regarding the vehicleidentification information stored in the data frame storage 11. That is,as for data such as vehicle identification information, the same valueas the latest data stored in the data frame storage 11 is always storedin the signal segment. Then, the prediction data generation unit 14generates a prediction data frame by combining the signal segment thatstores the prediction data generated based on the predicted generationmethod and the signal segment that always stores constant data such asvehicle identification information.

According to the first embodiment, the data included in the data framethat invalidates the unauthorized frame is set as the prediction data ofthe normal data that should be included in the data frame. This makes itpossible to properly control the transmission-destination electroniccontrol unit. Furthermore, the prediction data is used as the data atthe transmission time of the data frame. This makes it possible tocontrol the transmission-destination electronic control unit withinformation suitable for the state at the time of transmission, even fordata that changes over time.

Second Embodiment

In the above-described first embodiment, the prediction data generationunit 14 is configured to generate prediction data mainly for the dataframe stored in the data frame storage 11. In contrast, the predictiondata generation unit 14 may further acquire data directly from a sensoror the like connected to the electronic control unit 100, and use thisdata to generate a prediction data.

FIG. 9 shows the electronic control system of this embodiment. Unlikethe electronic control system shown in FIG. 1 , a sensor (correspondingto a sensor device) 104 is connected to the electronic control unit 100.Note that, in FIG. 9 , only the sensor 104 is connected to theelectronic control unit 100, but it goes without saying that theelectronic control unit 100 may be connected to a plurality of sensors.Further, the electronic control unit 100 may be connected to a sensorconnected to the transmission-source electronic control unit 102 and/orthe transmission-destination electronic control unit 103.

The sensor 104 connected to the electronic control unit 100 is adistance measurement sensor that detects data indicating the state ofthe vehicle (corresponding to vehicle data), for example, theinter-vehicle distance between the front vehicle and the host vehicle.Here, in the first embodiment, when the brake request is generated asthe prediction data, the actual inter-vehicle distance R between thefront vehicle and the host vehicle stored in the data frame storage 11is read and used. In the case that the distance measurement sensor isprovided as in the second embodiment, the data frame stored in the dataframe storage 11 is not read out, but the data of the inter-vehicledistance R is received from the sensor 104. The received data may becompared with the predicted braking distance R0 obtained by Expression(7). Of course, the sensor to which the electronic control unit 100 isconnected is not limited to the distance measurement sensor according tothe above example, and can be connected to any sensor.

According to the second embodiment, the electronic control unit 100 candirectly acquire data from the sensor and generate a prediction data.Suppose a case that an appropriate number of data frames for generatingthe prediction data is not stored in the data frame storage 11, forinstance, a case that the number of data frames sufficient to generatethe prediction data is not stored in the data frame storage 11immediately after the vehicle is started. Even in such cases, by usingthe data obtained directly from the sensor together, the electroniccontrol unit 100 can generate the prediction data. Furthermore, theelectronic control unit 100 acquires data directly from the sensor. Bydoing so, it is possible to generate a prediction data using the latestdata. Therefore, it is possible to improve the certainty of theprediction data, and it is possible to appropriately control thetransmission-destination electronic control unit by using the latestdata.

Third Embodiment

The above-described first embodiment has described the configuration inwhich the prediction data generation unit 14 generates the predictiondata whenever the data frame is abnormal. However, the prediction datageneration unit 14 may be configured to generate the prediction dataonly when a specific condition is satisfied even when there is anabnormality in the data frame.

FIG. 10 shows an electronic control unit 200 according to a thirdembodiment. The same elements as those of the electronic control unit100 shown in FIG. 2 are designated by the same reference signs, and thedescription thereof will be omitted. The electronic control unit 200shown in FIG. 10 includes a data generation determination unit 16 inaddition to the elements shown in FIG. 2 .

When the abnormality determination unit 13 determines that the dataframe is abnormal, the data generation determination unit 16(corresponding to the determination unit) determines whether theprediction data generation unit 14 needs to generate the predictiondata. The determination result is then notified to the prediction datageneration unit 14. Then, when the determination result notified fromthe data generation determination unit 16 indicates that the predictiondata needs to be generated, the prediction data generation unit 14generates the prediction data based on the above-described embodiment.

In a first example, the data generation determination unit 16 determinesexecution of generation of prediction data only when the type of dataincluded in the data frame determined to be abnormal is a preset datatype. For example, data such as vehicle speed, engine speed, andsteering angle are data that are directly related to the running of thevehicle and affect the safety of the vehicle. Therefore, in order torealize safe running of the vehicle, it is desirable to prevent theelectronic control unit from being controlled by the unauthorized dataframe when the data frame including such data is incorrectlytransmitted.

Therefore, specific data such as data related to vehicle safety ispreviously set. When the type of data included in the data framedetermined to be abnormal and the set data type are the same, the datageneration determination unit 16 determines to generate a predictiondata.

In a second example, the data generation determination unit 16 obtains adifference between (i) a data included in the data frame determined tobe abnormal and (ii) the latest data of the same type as that of thedata included in the data frame determined to be abnormal among the dataframes stored in the data frame storage 11. The data generationdetermination unit 16 may determine whether to generate prediction databased on the obtained difference.

For example, the data generation determination unit 16 compares thedifference between the abnormal data and the latest data with a presetallowable difference. When the difference is equal to or larger than theallowable difference, it is determined that the prediction data is to begenerated. Specifically, suppose a case where when the allowabledifference of the data regarding the vehicle speed is set to 5 km/h, theabnormal data indicates the vehicle speed of 65 km/h and the latest datastored in the data frame storage 11 indicates a vehicle speed of 50km/h. In this case, the difference between the abnormal data and thelatest data is 15 km/h is equal to or more than the allowabledifference. Therefore, the data generation determination unit 16determines to generate the prediction data and notifies the predictiondata generation unit 14 of the determination result. On the other hand,suppose a case where the abnormal data indicates the vehicle speed of 52km/h, and the latest data stored in the data frame storage 11 indicatesthe vehicle speed of 50 km/h. In this case, the difference between theabnormal data and the latest data is 2 km/h, is less than or equal tothe allowable difference. Therefore, the data generation determinationunit 16 determines not to generate a prediction data and notifies theprediction data generation unit 14 of the determination result.

There is a case where the data frame determined to be abnormal includesmultiple signal segments. In such a case, only the abnormal data storedin a specific signal segment (for example, the signal segment A) may becompared with the latest data stored in the data frame storage 11 andthe allowable difference. In this case, the data generationdetermination unit 16 does not consider an abnormal data stored in thesignal segment (for example, the signal segment B) other than the signalsegment A in the determination of whether to generate the predictiondata.

In a third example, the data generation determination unit 16 mayfurther monitor the load of the communication network 101 and determinewhether to generate a prediction data based on the load of thecommunication network 101.

When the prediction data is generated in the electronic control unit 100of this embodiment, the load of the communication network 101 increasesby transmitting the prediction data frame including the generatedprediction data. Therefore, when the load on the communication network101 is high, transmitting the predicted data frame may hindertransmission/reception of a more important data frame. Therefore, thedata generation determination unit 16 compares, for example, the load ofthe communication network 101 with a preset threshold value of the loadof the communication network. When the load of the communication network101 is lower than the threshold value, it is determined that thepredicted data is generated. In contrast, when the load of thecommunication network 101 is higher than the threshold value, it isdetermined that the predicted data is not generated. The abovedetermination results are notified to the prediction data generationunit 14.

In a fourth example, the data generation determination unit 16 furthermonitors the “reception frequency” at which the receiver 10 receives thedata frame determined to be abnormal. It may be determined whether togenerate a prediction data based on the reception frequency. Here, the“reception frequency” includes the number of times or an interval. Thatis, the number of times includes the number of times an abnormal dataframe was received within a certain period, or the number of times anabnormal data frame was received in succession. The interval includes areception interval of abnormal data frames.

For example, suppose a case where multiple data frames that have beendetermined to be abnormal are received in succession. In such a case,the prediction data generation unit 14 does not generate a predictiondata for all the data frames determined to be abnormal, but generates aprediction data for every fixed number of received multiple data frames,or for every fixed time. The prediction data frame including thegenerated prediction data may be transmitted from the transmitter 15.

The transmission-destination electronic control unit 103 reads out thelatest data frame from the received data frames by LIFO control, andcontrols based on the data included in the latest data frame. That is,even if the electronic control unit 100 transmits a plurality ofprediction data frames including a prediction data, thetransmission-destination electronic control unit 103 uses only thelatest prediction data frame, and invalidates other prediction dataframes. As described above, the electronic control unit 100 transmitsthe predicted data frame that is not used by thetransmission-destination electronic control unit 103, thereby increasingthe load on the communication network 101. Therefore, transmission andreception of more important data frames may be hindered. In particular,if the abnormal data frames are continuously received and the predicteddata frames are continuously transmitted accordingly, the load on thecommunication network 101 increases rapidly. Therefore, the datageneration determination unit 16 monitors and counts the number of timesa data frame having an abnormality is received within a certain periodor continuously. At the same time, the counted number of times ofreception is compared with a preset threshold number of times. Then,when the counted number of times of reception is higher than thethreshold number of times, it is determined that the predicted data willnot be generated for a certain number of times or for a certain periodof time. On the other hand, when a certain number of times or a certainperiod of time has elapsed, it is determined that the prediction datawill be generated. The determination result is thereby notified to theprediction data generation unit 14. In addition, the threshold number oftimes or the time serving as a criterion for determining whether togenerate the prediction data may be different depending on the type ofdata.

(Overview)

The electronic control unit and the electronic control system in eachembodiment have been described above.

The terms used in the above embodiments are mere examples, and may bereplaced with terms having the same meaning or terms having the samefunctions.

The block diagrams used in the description of the embodiments are adiagram in which the elements of the electronic control unit and thelike are classified and organized by functions. These functional blocksare realized by any combination of hardware or software. Further, sincethe functions are shown, the block diagram can be understood as thedisclosure of the method.

The order of the functional blocks that can be grasped as the process,sequence, and method described in each embodiment may be changed unlessthere is a constraint such that the result of another step is used inone step.

Each of the embodiments is premised on an electronic control unit and anelectronic control system for a vehicle mounted on the vehicle. However,this description also discloses an information processing systemincluding a special-purpose or general-purpose electronic control systemother than that for a vehicle, and an information processing deviceincluding a special-purpose or general-purpose electronic control unit.

Examples of the electronic control unit according to the presentdisclosure include a semiconductor device, an electronic circuit, amodule, and a microcomputer. In addition, necessary functions such as anantenna and a communication interface may be added to these devices.Moreover, it may be also possible to provide features such as a carnavigation system, a smartphone, a personal computer, and a portableinformation terminal.

In addition, the present disclosure can be realized by special-purposehardware having the configuration and function described in eachembodiment. In addition, it can be realized as a combination of aprogram for realizing the present disclosure stored in a storage mediumsuch as a memory or a hard disk, and a general-purpose hardware having aspecial-purpose or general-purpose CPU and memory capable of executingthe program.

The program may be stored in a special-purpose or general-purposehardware storage medium (external storage device (hard disk, USB memory,CD/BD, etc.), an internal storage (RAM, ROM, etc.), or a non-transitorytangible storage medium. Such a program may be provided tospecial-purpose or general-purpose hardware via a storage medium or viaa communication line from a server without using the storage medium.Consequently, when the program is upgraded, the latest function isalways provided.

INDUSTRIAL APPLICABILITY

The electronic control unit of the present disclosure has been describedmainly as a vehicular electronic control unit mounted in an automobile.However, the electronic control unit of the present disclosure can beapplied to general moving objects such as motorcycles, bicycles withelectric motors, railroads, ships, and aircraft.

For reference to further explain features of the present disclosure, thedescription is added as follows.

In recent years, various types of electronic control units, which areconnected to each other via an in-vehicle network such as a CAN(Controller Area Network), are mounted on an automobile. Theseelectronic control units include electronic control units that controlthe operation of the vehicle, such as the engine and steering wheel.Therefore, in order to ensure the safety of the vehicle, high securityis required to prevent the electronic control unit from beingincorrectly controlled by an unauthorized access by a third party, or toinvalidate the unauthorized control performed by a third party.

There is a frame monitoring apparatus as follows. When an unauthorizedframe is transmitted/received in an in-vehicle system, a cancellationframe for invalidating the unauthorized frame is transmitted by usingLIFO (Last In First Out) control; the electronic control unit is thusprevented from being controlled by the unauthorized frame. Further, whenthe frame monitoring apparatus determines that the transmitted/receivedframe is an unauthorized frame, it transmits a frame having the samecontent as a regular frame received immediately before the unauthorizedframe as a cancellation frame.

According to the described technique, the electronic control unit, whichis the transmission-destination of the frame, is controlled based on thecontrol information included in the cancellation frame received afterthe unauthorized frame. The electronic control unit can thus beprevented from being controlled by the unauthorized frame. By the way,there is a time lag from the transmission of the regular frameimmediately before the unauthorized frame to the transmission of theunauthorized frame or the cancellation frame. When a frame having thesame content as the immediately preceding regular frame is used as thecancellation frame, the change in vehicle condition over time that mayoccur due to such a time lag may be not considered. Therefore, theinventors have found that it may not be appropriate to use the controlinformation included in the immediately preceding regular frame as thecontrol information included in the cancellation frame.

It is thus desired to predict a normal data that should be included in adata frame, and invalidate an unauthorized frame using a frame thatincludes the predicted normal data (i.e., a prediction data).

Aspects of the present disclosure described herein are set forth in thefollowing clauses.

According to a first aspect of the present disclosure, an electroniccontrol unit is provided to include a receiver, a first storage, asecond storage, an abnormality determination unit, a prediction datageneration unit, and a transmitter. The receiver is configured toreceive a data frame transmitted from a different electronic controlunit via a communication network. The first storage is configured tostore the data frame. The second storage is configured to store aprediction generation method to predict and generate a data included inthe data frame. The abnormality determination unit is configured todetermine whether the data frame is abnormal. The prediction datageneration unit is configured to generate a prediction data, which ispredicted to be a normal data that is supposed to be included in thedata frame that is determined to be abnormal, by using a past data thatis a data included in the data frame stored in the first storage, basedon the prediction generation method stored in the second storage. Thetransmitter is configured to transmit a prediction data frame includingthe prediction data via the communication network.

According to a second aspect of the present disclosure, an electroniccontrol system is provided to include a first electronic control unit, asecond electronic control unit, and a third electronic control unit.

The first electronic control unit is configured to transmit a data framevia a communication network.

The second electronic control unit is configured to include a receiver,a first storage, a second storage, an abnormality determination unit, aprediction data generation unit, and a transmitter. The receiver isconfigured to receive a data frame transmitted from a differentelectronic control unit via a communication network. The first storageis configured to store the data frame. The second storage is configuredto store a prediction generation method to predict and generate a dataincluded in the data frame. The abnormality determination unit isconfigured to determine whether the data frame is abnormal. Theprediction data generation unit is configured to generate a predictiondata, which is predicted to be a normal data that is supposed to beincluded in the data frame that is determined to be abnormal, by using apast data that is a data included in the data frame stored in the firststorage, based on the prediction generation method stored in the secondstorage. The transmitter is configured to transmit a prediction dataframe including the prediction data via the communication network.

The third electronic control unit is configured to receive the dataframe transmitted from the first electronic control unit and theprediction data frame transmitted from the second electronic controlunit; the third electronic control unit is configured to perform acontrol based on the prediction data frame.

According to a third aspect of the present disclosure, a prediction datageneration program is provided as follows: receiving a data frametransmitted from a different electronic control unit via a communicationnetwork; storing the data frame in a first storage; determine whetherthe data frame is abnormal; generating a prediction data, which ispredicted to be a normal data that is supposed to be included in thedata frame that is determined to be abnormal, by using a past data thatis a data included in the data frame stored in the first storage, basedon a prediction generation method stored in a second storage; andtransmitting a prediction data frame including the prediction data viathe communication network.

According to a fourth aspect of the present disclosure, a predictiondata generation method is provided as follows: receiving a data frametransmitted from a different electronic control unit via a communicationnetwork; storing the data frame in a first storage; determine whetherthe data frame is abnormal; generating a prediction data, which ispredicted to be a normal data that is supposed to be included in thedata frame that is determined to be abnormal, by using a past data thatis a data included in the data frame stored in the first storage, basedon a prediction generation method stored in a second storage; andtransmitting a prediction data frame including the prediction data viathe communication network.

Effects

According to the electronic control unit, the electronic control system,the prediction data generation program, and the prediction datageneration method of the present disclosure, it is possible toinvalidate an unauthorized frame by using a frame including data havingappropriate content.

What is claimed is:
 1. An electronic control unit comprising: a receiverconfigured to receive a data frame transmitted from a differentelectronic control unit via a communication network; a first storageconfigured to store the data frame; a second storage configured to storea plurality of prediction generation methods to predict and generate adata included in the data frame; an abnormality determination unitconfigured to determine whether the data frame is abnormal; a predictiondata generation unit configured to select one prediction generationmethod from the plurality of prediction generation methods stored in thesecond storage based on a type of an abnormal data that is a dataincluded in the data frame that is determined to be abnormal, andgenerate a prediction data, which is predicted to be a normal data thatis supposed to be included in the data frame that is determined to beabnormal, by using a past data that is a data included in the data framestored in the first storage, based on the selected one predictiongeneration method; and a transmitter configured to transmit a predictiondata frame including the prediction data via the communication network.2. The electronic control unit according to claim 1, wherein: thetransmitter is configured to transmit the prediction data frame at apredetermined transmission time after the prediction data is generated;and the prediction data generation unit is configured to generate, asthe prediction data, a normal data that is supposed to be included inthe data frame determined to be abnormal under an assumption that thedata frame determined to be abnormal is transmitted at the predeterminedtransmission time.
 3. The electronic control unit according to claim 2,wherein: the prediction data generation unit is configured to furthergenerate the prediction data using the predetermined transmission time.4. The electronic control unit according to claim 1, wherein: theprediction data generation unit is configured to generate the predictiondata predicted from the past data with a type identical to a type of theabnormal data included in the data frame determined to be abnormal. 5.The electronic control unit according to claim 1, wherein: theelectronic control unit is mounted on a vehicle and is connected to asensor configured to detect a vehicle data indicating a state of thevehicle; and the prediction data generation unit is configured tofurther generate the prediction data using the vehicle data detected bythe sensor.
 6. The electronic control unit according to claim 1, furthercomprising: a determination unit configured to determine whether togenerate the prediction data based on a type of the abnormal dataincluded in the data frame determined to be abnormal.
 7. The electroniccontrol unit according to claim 1, further comprising: a determinationunit configured to determine whether to generate the prediction databased on a difference between the abnormal data included in the dataframe determined to be abnormal and a latest data of the past data witha type identical to a type of the abnormal data.
 8. The electroniccontrol unit according to claim 1, further comprising: a determinationunit configured to monitor a load of the communication network, anddetermine whether to generate the prediction data based on the load. 9.The electronic control unit according to claim 1, further comprising: adetermination unit configured to monitor a reception frequency of thedata frame determined to be abnormal and determine whether to generatethe prediction data based on the reception frequency.
 10. An electroniccontrol unit comprising: a receiver configured to receive a data frametransmitted from a different electronic control unit via a communicationnetwork; a first storage configured to store the data frame; a secondstorage configured to store a prediction generation method to predictand generate a data included in the data frame; an abnormalitydetermination unit configured to determine whether the data frame isabnormal; a prediction data generation unit configured to generate aprediction data predicted to be a normal data that is supposed to beincluded in the data frame determined to be abnormal, based on theprediction generation method, by using a past data that is a dataincluded in the data frame stored in the first storage, the past datahaving a type different from a type of an abnormal data that is a dataincluded in the data frame determined to be abnormal; and a transmitterconfigured to transmit a prediction data frame including the predictiondata via the communication network.
 11. The electronic control unitaccording to claim 10, wherein: the transmitter is configured totransmit the prediction data frame at a predetermined transmission timeafter the prediction data is generated; and the prediction datageneration unit is configured to generate, as the prediction data, anormal data that is supposed to be included in the data frame determinedto be abnormal under an assumption that the data frame determined to beabnormal is transmitted at the predetermined transmission time.
 12. Theelectronic control unit according to claim 11, wherein: the predictiondata generation unit is configured to further generate the predictiondata using the predetermined transmission time.
 13. The electroniccontrol unit according to claim 10, wherein: the prediction datageneration unit is configured to generate the prediction data predictedfrom the past data with a type identical to a type of the abnormal dataincluded in the data frame determined to be abnormal.
 14. The electroniccontrol unit according to claim 10, wherein: the electronic control unitis mounted on a vehicle and is connected to a sensor configured todetect a vehicle data indicating a state of the vehicle; and theprediction data generation unit is configured to further generate theprediction data using the vehicle data.
 15. The electronic control unitaccording to claim 10, further comprising: a determination unitconfigured to determine whether to generate the prediction data based ona type of the abnormal data included in the data frame that isdetermined to be abnormal.
 16. The electronic control unit according toclaim 10, further comprising: a determination unit configured todetermine whether to generate the prediction data based on a differencebetween the abnormal data included in the data frame determined to beabnormal and a latest data of the past data with a type identical to atype of the abnormal data.
 17. The electronic control unit according toclaim 10, further comprising: a determination unit configured to monitora load of the communication network and determine whether to generatethe prediction data based on the load.
 18. The electronic control unitaccording to claim 10, further comprising: a determination unitconfigured to monitor a reception frequency of the data frame determinedto be abnormal and determine whether to generate the prediction databased on the reception frequency.
 19. An electronic control systemcomprising: a first electronic control unit configured to transmit adata frame via a communication network; a second electronic control unitcomprising a receiver configured to receive the data frame, a firststorage configured to store the data frame, a second storage configuredto storing a plurality of prediction generation methods to predict andgenerate a data included in the data frame, an abnormality determinationunit configured to determine whether the data frame is abnormal, aprediction data generation unit configured to select one predictiongeneration method from the plurality of prediction generation methodsstored in the second storage based on a type of an abnormal data that isa data included in the data frame that is determined to be abnormal, andgenerate a prediction data, which is predicted to be a normal data thatis supposed to be included in the data frame that is determined to beabnormal, by using a past data that is a data included in the data framestored in the first storage, based on the selected one predictiongeneration method, and a transmitter configured to transmit a predictiondata frame including the prediction data via the communication network;and a third electronic control unit configured to receive the data frametransmitted from the first electronic control unit and the predictiondata frame transmitted from the second electronic control unit, thethird electronic control unit being configured to perform a controlbased on the prediction data frame.
 20. The electronic control systemaccording to claim 19, further comprising: a sensor connected to thesecond electronic control unit, wherein: the electronic control systemis mounted on a vehicle; the sensor is configured to detect a vehicledata indicating a state of the vehicle; and the prediction datageneration unit is configured to generate the prediction data using thevehicle data detected by the sensor.
 21. A computer-implementedprediction data generation method executed by a computer, comprising:receiving a data frame transmitted from a different electronic controlunit via a communication network; storing the data frame in a firststorage; determining whether the data frame is abnormal; selecting oneprediction generation method from a plurality of prediction generationmethods stored in a second storage based on a type of an abnormal datathat is a data included in the data frame that is determined to beabnormal; generating a prediction data, which is predicted to be anormal data that is supposed to be included in the data frame that isdetermined to be abnormal, by using a past data that is a data includedin the data frame stored in the first storage, based on the selected oneprediction generation method; and transmitting a prediction data frameincluding the prediction data via the communication network.
 22. Anon-transitory computer-readable storage medium comprising a predictiondata generation program including instructions executable by a computer,the instructions including the computer-implemented prediction datageneration method according to claim
 21. 23. The electronic control unitaccording to claim 1, further comprising: one or more than one processorcoupled to the receiver, the first storage, the second storage, and thetransmitter via a communication link, the processor implementing theabnormality determination unit and the prediction data generation unit.